approval-md 0.3.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (270) hide show
  1. package/README.md +83 -914
  2. package/SPEC.md +101 -13
  3. package/cli.js +134 -7
  4. package/dist/src/adapters/smtp.d.ts +18 -0
  5. package/dist/src/adapters/smtp.js +24 -3
  6. package/dist/src/adapters/smtp.js.map +1 -1
  7. package/dist/src/channels/contract.d.ts +72 -0
  8. package/dist/src/channels/contract.js +161 -1
  9. package/dist/src/channels/contract.js.map +1 -1
  10. package/dist/src/channels/relay-server.d.ts +90 -0
  11. package/dist/src/channels/relay-server.js +295 -0
  12. package/dist/src/channels/relay-server.js.map +1 -0
  13. package/dist/src/channels/relay.d.ts +273 -0
  14. package/dist/src/channels/relay.js +564 -0
  15. package/dist/src/channels/relay.js.map +1 -0
  16. package/dist/src/channels/tagging.d.ts +25 -0
  17. package/dist/src/channels/tagging.js +63 -6
  18. package/dist/src/channels/tagging.js.map +1 -1
  19. package/dist/src/channels/telegram-minimal.d.ts +251 -0
  20. package/dist/src/channels/telegram-minimal.js +618 -0
  21. package/dist/src/channels/telegram-minimal.js.map +1 -0
  22. package/dist/src/channels/telegram-webhook.d.ts +273 -0
  23. package/dist/src/channels/telegram-webhook.js +536 -0
  24. package/dist/src/channels/telegram-webhook.js.map +1 -0
  25. package/dist/src/channels/telegram.d.ts +725 -20
  26. package/dist/src/channels/telegram.js +1332 -123
  27. package/dist/src/channels/telegram.js.map +1 -1
  28. package/dist/src/cli/amend.js +358 -5
  29. package/dist/src/cli/amend.js.map +1 -1
  30. package/dist/src/cli/attest.js +43 -6
  31. package/dist/src/cli/attest.js.map +1 -1
  32. package/dist/src/cli/audit-card.d.ts +1 -1
  33. package/dist/src/cli/audit-card.js +40 -1
  34. package/dist/src/cli/audit-card.js.map +1 -1
  35. package/dist/src/cli/audit.d.ts +7 -5
  36. package/dist/src/cli/audit.js +22 -10
  37. package/dist/src/cli/audit.js.map +1 -1
  38. package/dist/src/cli/channel-relay.d.ts +108 -0
  39. package/dist/src/cli/channel-relay.js +334 -0
  40. package/dist/src/cli/channel-relay.js.map +1 -0
  41. package/dist/src/cli/channel-telegram-webhook.d.ts +275 -0
  42. package/dist/src/cli/channel-telegram-webhook.js +716 -0
  43. package/dist/src/cli/channel-telegram-webhook.js.map +1 -0
  44. package/dist/src/cli/channel-telegram.d.ts +347 -28
  45. package/dist/src/cli/channel-telegram.js +648 -56
  46. package/dist/src/cli/channel-telegram.js.map +1 -1
  47. package/dist/src/cli/channel.d.ts +1 -1
  48. package/dist/src/cli/channel.js +5 -1
  49. package/dist/src/cli/channel.js.map +1 -1
  50. package/dist/src/cli/daemon.js +37 -5
  51. package/dist/src/cli/daemon.js.map +1 -1
  52. package/dist/src/cli/doctor.d.ts +63 -0
  53. package/dist/src/cli/doctor.js +856 -111
  54. package/dist/src/cli/doctor.js.map +1 -1
  55. package/dist/src/cli/execute.d.ts +29 -1
  56. package/dist/src/cli/execute.js +387 -21
  57. package/dist/src/cli/execute.js.map +1 -1
  58. package/dist/src/cli/exit-codes.d.ts +12 -0
  59. package/dist/src/cli/exit-codes.js +13 -0
  60. package/dist/src/cli/exit-codes.js.map +1 -1
  61. package/dist/src/cli/gate.d.ts +2 -0
  62. package/dist/src/cli/gate.js +233 -2
  63. package/dist/src/cli/gate.js.map +1 -1
  64. package/dist/src/cli/help.d.ts +10 -1
  65. package/dist/src/cli/help.js +283 -54
  66. package/dist/src/cli/help.js.map +1 -1
  67. package/dist/src/cli/hook.d.ts +485 -6
  68. package/dist/src/cli/hook.js +2370 -70
  69. package/dist/src/cli/hook.js.map +1 -1
  70. package/dist/src/cli/init.js +16 -7
  71. package/dist/src/cli/init.js.map +1 -1
  72. package/dist/src/cli/instructions.js +24 -3
  73. package/dist/src/cli/instructions.js.map +1 -1
  74. package/dist/src/cli/log-anchor.d.ts +55 -0
  75. package/dist/src/cli/log-anchor.js +199 -60
  76. package/dist/src/cli/log-anchor.js.map +1 -1
  77. package/dist/src/cli/log-unlock.d.ts +23 -0
  78. package/dist/src/cli/log-unlock.js +109 -0
  79. package/dist/src/cli/log-unlock.js.map +1 -0
  80. package/dist/src/cli/main.d.ts +0 -12
  81. package/dist/src/cli/main.js +72 -4
  82. package/dist/src/cli/main.js.map +1 -1
  83. package/dist/src/cli/muse.d.ts +2 -0
  84. package/dist/src/cli/muse.js +62 -0
  85. package/dist/src/cli/muse.js.map +1 -0
  86. package/dist/src/cli/payload.js +79 -1
  87. package/dist/src/cli/payload.js.map +1 -1
  88. package/dist/src/cli/scaffold.js +6 -0
  89. package/dist/src/cli/scaffold.js.map +1 -1
  90. package/dist/src/cli/serve.d.ts +53 -0
  91. package/dist/src/cli/serve.js +270 -0
  92. package/dist/src/cli/serve.js.map +1 -0
  93. package/dist/src/cli/up.js +26 -2
  94. package/dist/src/cli/up.js.map +1 -1
  95. package/dist/src/cli/verb-registry.d.ts +2 -0
  96. package/dist/src/cli/verb-registry.js +338 -39
  97. package/dist/src/cli/verb-registry.js.map +1 -1
  98. package/dist/src/cli/wordmark.d.ts +2 -2
  99. package/dist/src/cli/wordmark.js +2 -2
  100. package/dist/src/core/attest-bootstrap.d.ts +95 -0
  101. package/dist/src/core/attest-bootstrap.js +135 -0
  102. package/dist/src/core/attest-bootstrap.js.map +1 -0
  103. package/dist/src/core/attest.d.ts +20 -3
  104. package/dist/src/core/attest.js +25 -0
  105. package/dist/src/core/attest.js.map +1 -1
  106. package/dist/src/core/audit.d.ts +153 -12
  107. package/dist/src/core/audit.js +415 -20
  108. package/dist/src/core/audit.js.map +1 -1
  109. package/dist/src/core/channel-lease.d.ts +322 -0
  110. package/dist/src/core/channel-lease.js +663 -0
  111. package/dist/src/core/channel-lease.js.map +1 -0
  112. package/dist/src/core/command-class.d.ts +51 -0
  113. package/dist/src/core/command-class.js +766 -8
  114. package/dist/src/core/command-class.js.map +1 -1
  115. package/dist/src/core/daemon-host.d.ts +178 -0
  116. package/dist/src/core/daemon-host.js +228 -0
  117. package/dist/src/core/daemon-host.js.map +1 -0
  118. package/dist/src/core/daemon-identity.d.ts +238 -0
  119. package/dist/src/core/daemon-identity.js +252 -0
  120. package/dist/src/core/daemon-identity.js.map +1 -0
  121. package/dist/src/core/gate.d.ts +364 -6
  122. package/dist/src/core/gate.js +802 -27
  123. package/dist/src/core/gate.js.map +1 -1
  124. package/dist/src/core/harness-version.d.ts +128 -4
  125. package/dist/src/core/harness-version.js +179 -12
  126. package/dist/src/core/harness-version.js.map +1 -1
  127. package/dist/src/core/harness-wait.d.ts +82 -3
  128. package/dist/src/core/harness-wait.js +89 -3
  129. package/dist/src/core/harness-wait.js.map +1 -1
  130. package/dist/src/core/log-lock.d.ts +435 -0
  131. package/dist/src/core/log-lock.js +1093 -0
  132. package/dist/src/core/log-lock.js.map +1 -0
  133. package/dist/src/core/log-subscribe.d.ts +21 -0
  134. package/dist/src/core/log-subscribe.js +16 -6
  135. package/dist/src/core/log-subscribe.js.map +1 -1
  136. package/dist/src/core/log-write-layer.d.ts +55 -0
  137. package/dist/src/core/log-write-layer.js +91 -0
  138. package/dist/src/core/log-write-layer.js.map +1 -0
  139. package/dist/src/core/log.d.ts +130 -22
  140. package/dist/src/core/log.js +473 -50
  141. package/dist/src/core/log.js.map +1 -1
  142. package/dist/src/core/payload-census.d.ts +51 -0
  143. package/dist/src/core/payload-census.js +125 -2
  144. package/dist/src/core/payload-census.js.map +1 -1
  145. package/dist/src/core/payload-store.d.ts +31 -0
  146. package/dist/src/core/payload-store.js +113 -8
  147. package/dist/src/core/payload-store.js.map +1 -1
  148. package/dist/src/core/payload.d.ts +18 -3
  149. package/dist/src/core/payload.js +20 -4
  150. package/dist/src/core/payload.js.map +1 -1
  151. package/dist/src/core/policy-diff.d.ts +10 -0
  152. package/dist/src/core/policy-diff.js +10 -2
  153. package/dist/src/core/policy-diff.js.map +1 -1
  154. package/dist/src/core/policy-explain.d.ts +7 -1
  155. package/dist/src/core/policy-explain.js +16 -1
  156. package/dist/src/core/policy-explain.js.map +1 -1
  157. package/dist/src/core/policy-load.d.ts +24 -0
  158. package/dist/src/core/policy-load.js.map +1 -1
  159. package/dist/src/core/policy-match.d.ts +38 -0
  160. package/dist/src/core/policy-match.js +35 -0
  161. package/dist/src/core/policy-match.js.map +1 -1
  162. package/dist/src/core/policy-proposal.d.ts +40 -0
  163. package/dist/src/core/policy-proposal.js +37 -16
  164. package/dist/src/core/policy-proposal.js.map +1 -1
  165. package/dist/src/core/prompt-layout.d.ts +186 -1
  166. package/dist/src/core/prompt-layout.js +345 -3
  167. package/dist/src/core/prompt-layout.js.map +1 -1
  168. package/dist/src/core/read-scope.d.ts +10 -0
  169. package/dist/src/core/read-scope.js +4 -0
  170. package/dist/src/core/read-scope.js.map +1 -1
  171. package/dist/src/core/run-payload.d.ts +160 -0
  172. package/dist/src/core/run-payload.js +304 -0
  173. package/dist/src/core/run-payload.js.map +1 -0
  174. package/dist/src/core/sender-identity.d.ts +59 -11
  175. package/dist/src/core/sender-identity.js +79 -11
  176. package/dist/src/core/sender-identity.js.map +1 -1
  177. package/dist/src/core/state.d.ts +52 -1
  178. package/dist/src/core/state.js +52 -6
  179. package/dist/src/core/state.js.map +1 -1
  180. package/dist/src/core/telegram-config.d.ts +79 -0
  181. package/dist/src/core/telegram-config.js +108 -0
  182. package/dist/src/core/telegram-config.js.map +1 -1
  183. package/dist/src/core/validate.d.ts +20 -6
  184. package/dist/src/core/validate.js +0 -0
  185. package/dist/src/core/validate.js.map +1 -1
  186. package/dist/src/core/verify.d.ts +23 -1
  187. package/dist/src/core/verify.js +20 -2
  188. package/dist/src/core/verify.js.map +1 -1
  189. package/dist/src/daemon/audit.d.ts +80 -5
  190. package/dist/src/daemon/audit.js +126 -6
  191. package/dist/src/daemon/audit.js.map +1 -1
  192. package/dist/src/daemon/daemon.d.ts +174 -2
  193. package/dist/src/daemon/daemon.js +298 -7
  194. package/dist/src/daemon/daemon.js.map +1 -1
  195. package/dist/src/daemon/git-evidence.d.ts +2 -2
  196. package/dist/src/daemon/git-evidence.js +1 -1
  197. package/dist/src/daemon/projection.d.ts +13 -2
  198. package/dist/src/daemon/projection.js +39 -6
  199. package/dist/src/daemon/projection.js.map +1 -1
  200. package/dist/src/mcp/server.d.ts +39 -3
  201. package/dist/src/mcp/server.js +22 -3
  202. package/dist/src/mcp/server.js.map +1 -1
  203. package/dist/src/muse/server.d.ts +16 -0
  204. package/dist/src/muse/server.js +238 -0
  205. package/dist/src/muse/server.js.map +1 -0
  206. package/dist/src/serve/archive.d.ts +166 -0
  207. package/dist/src/serve/archive.js +363 -0
  208. package/dist/src/serve/archive.js.map +1 -0
  209. package/dist/src/serve/arguments.d.ts +93 -0
  210. package/dist/src/serve/arguments.js +228 -0
  211. package/dist/src/serve/arguments.js.map +1 -0
  212. package/dist/src/serve/credentials.d.ts +91 -0
  213. package/dist/src/serve/credentials.js +143 -0
  214. package/dist/src/serve/credentials.js.map +1 -0
  215. package/dist/src/serve/follow.d.ts +86 -0
  216. package/dist/src/serve/follow.js +101 -0
  217. package/dist/src/serve/follow.js.map +1 -0
  218. package/dist/src/serve/hook-thread.d.ts +134 -0
  219. package/dist/src/serve/hook-thread.js +333 -0
  220. package/dist/src/serve/hook-thread.js.map +1 -0
  221. package/dist/src/serve/hook-worker.d.ts +134 -0
  222. package/dist/src/serve/hook-worker.js +173 -0
  223. package/dist/src/serve/hook-worker.js.map +1 -0
  224. package/dist/src/serve/server.d.ts +412 -0
  225. package/dist/src/serve/server.js +1251 -0
  226. package/dist/src/serve/server.js.map +1 -0
  227. package/docs/README-extended.md +768 -0
  228. package/docs/cli-reference.md +2139 -67
  229. package/package.json +4 -2
  230. package/schema/event.schema.json +413 -30
  231. package/schema/fixtures/event/invalid/audit-lock-reclaimed-age-without-created.json +19 -0
  232. package/schema/fixtures/event/invalid/audit-lock-reclaimed-agent-actor.json +14 -0
  233. package/schema/fixtures/event/invalid/audit-lock-reclaimed-lockfile-path.json +14 -0
  234. package/schema/fixtures/event/invalid/audit-lock-reclaimed-operator-cleared-system-actor.json +14 -0
  235. package/schema/fixtures/event/invalid/audit-lock-reclaimed-unknown-reason.json +14 -0
  236. package/schema/fixtures/event/invalid/audit-lock-reclaimed-without-age.json +13 -0
  237. package/schema/fixtures/event/invalid/audit-reviewed-agent-actor.json +6 -1
  238. package/schema/fixtures/event/invalid/audit-reviewed-bad-payload-hash.json +21 -0
  239. package/schema/fixtures/event/invalid/audit-reviewed-loved-no-note.json +5 -0
  240. package/schema/fixtures/event/invalid/audit-reviewed-no-subject-hash.json +19 -0
  241. package/schema/fixtures/event/invalid/audit-reviewed-no-subject-seq.json +19 -0
  242. package/schema/fixtures/event/invalid/audit-reviewed-no-verdict-source.json +19 -0
  243. package/schema/fixtures/event/invalid/audit-reviewed-no-verdict.json +19 -0
  244. package/schema/fixtures/event/invalid/audit-reviewed-system-actor.json +6 -1
  245. package/schema/fixtures/event/invalid/audit-sampled-no-policy-hash.json +14 -0
  246. package/schema/fixtures/event/invalid/daemon-id-malformed.json +15 -0
  247. package/schema/fixtures/event/invalid/execution-started-truncated-policy-sha256.json +18 -0
  248. package/schema/fixtures/event/invalid/harness-cap-at-margin.json +16 -0
  249. package/schema/fixtures/event/invalid/harness-cap-fractional.json +16 -0
  250. package/schema/fixtures/event/invalid/harness-cap-negative.json +16 -0
  251. package/schema/fixtures/event/invalid/harness-cap-string.json +16 -0
  252. package/schema/fixtures/event/invalid/harness-cap-without-harness-execution.json +16 -0
  253. package/schema/fixtures/event/invalid/harness-cap-zero.json +16 -0
  254. package/schema/fixtures/event/valid/approval-requested-harness-cap.json +18 -0
  255. package/schema/fixtures/event/valid/audit-lock-reclaimed-implausible-created.json +18 -0
  256. package/schema/fixtures/event/valid/audit-lock-reclaimed-legacy.json +14 -0
  257. package/schema/fixtures/event/valid/audit-lock-reclaimed-unlock.json +19 -0
  258. package/schema/fixtures/event/valid/audit-lock-reclaimed.json +19 -0
  259. package/schema/fixtures/event/valid/audit-reviewed-reaction.json +5 -0
  260. package/schema/fixtures/event/valid/audit-reviewed.json +6 -1
  261. package/schema/fixtures/event/valid/audit-sampled.json +2 -1
  262. package/schema/fixtures/event/valid/daemon-identity-declared.json +17 -0
  263. package/schema/fixtures/event/valid/daemon-identity.json +16 -0
  264. package/schema/fixtures/event/valid/execution-started-policy-sha256.json +18 -0
  265. package/schema/fixtures/event/valid/harness-kind-hermes.json +23 -0
  266. package/schema/fixtures/policy/invalid/daemons-malformed-id.json +10 -0
  267. package/schema/fixtures/policy/valid/daemons-allowlist.json +19 -0
  268. package/schema/fixtures/policy-md/invalid/schema-invalid-agent-may-request.md +21 -0
  269. package/schema/fixtures/policy-md/valid/agent-may-request.md +24 -0
  270. package/schema/policy.schema.json +102 -6
@@ -1 +1 @@
1
- {"version":3,"file":"help.js","sourceRoot":"","sources":["../../../src/cli/help.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAExE,0EAA0E;AAC1E,MAAM,UAAU,GAAG;;;;;0EAKuD,CAAC;AAE3E,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,MAAM,WAAW,GAAG;8BACU,CAAC;AAE/B,uDAAuD;AACvD,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO,8BAA8B,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+SvB,UAAU;;;;;;;;;;;EAWV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmC8D,CAAC;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;EAiB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;sCAqBc,kBAAkB;EACtD,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;EAoBzB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBvB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,GAAG,kBAAkB;;;;yDAIU,CAAC;AAE1D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,6EAA6E,CAAC;AAE5G,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;uDAiB4B,qBAAqB;;EAE1E,iBAAiB;EACjB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB/B,kBAAkB;EAClB,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,SAAS,cAAc,CAAC,IAAsB,EAAE,KAAuB;IACrE,OAAO,mBAAmB,IAAI;;;oBAGZ,IAAI;;;;;;;;6BAQK,KAAK;;EAEhC,qBAAqB;;;;EAIrB,iBAAiB;EACjB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG;EACzB,kBAAkB;qEACiD,CAAC;AAEtE,wEAAwE;AACxE,MAAM,mBAAmB,GAAG;EAC1B,kBAAkB;qEACiD,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,SAAS,YAAY,CAAC,IAAmC;IACvD,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1F,MAAM,IAAI,GACR,IAAI,KAAK,OAAO;QACd,CAAC,CAAC;;iFAEyE;QAC3E,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC;;oEAE0D;YAC5D,CAAC,CAAC;;gDAEsC,CAAC;IAE/C,OAAO,YAAY,IAAI,qBAAqB,IAAI;;;aAGrC,IAAI,gCACb,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAC3C;;;;iEAKE,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,EACN;;;;;;EAMA,IAAI;;oCAE8B,IAAI;EACtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;EAkBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;2DAY2B,gBAAgB;;;;;;;;;;;EAWzE,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;EAmBxB,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;EAmBvB,kBAAkB;;;EAGlB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBxB,kBAAkB;EAClB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;EAmB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;EAkBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAE3B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB5B,kBAAkB;EAClB,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB9B,kBAAkB;EAClB,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;6DAYoC,gBAAgB;IACzE,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;;;;;;;;EAQ/C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB7B,kBAAkB;EAClB,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBvB,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB5B,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB5B,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;EAUzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;EAc1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;EAoB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;EAmB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;EAoB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;EAWzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAEd,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,YAAY,GAAG;iEAC4C,CAAC;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,YAAY;;EAEZ,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;EAoB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;EAoB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAE;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;EAejC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;EAkB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;EAiBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;EAmBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;EAcpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;EAmBhC,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;EAezC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;yDAC4C,CAAC;AAE1D,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC"}
1
+ {"version":3,"file":"help.js","sourceRoot":"","sources":["../../../src/cli/help.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAExE,0EAA0E;AAC1E,MAAM,UAAU,GAAG;;;;;0EAKuD,CAAC;AAE3E,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,MAAM,WAAW,GAAG;8BACU,CAAC;AAE/B,uDAAuD;AACvD,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO,8BAA8B,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8UvB,UAAU;;;;;;;;;;;EAWV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmC8D,CAAC;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;EAiB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;+EAqBuD,kBAAkB;EAC/F,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;EAoBzB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;EAkB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBvB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,GAAG,kBAAkB;;;;yDAIU,CAAC;AAE1D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,6EAA6E,CAAC;AAE5G,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;uDAiB4B,qBAAqB;;EAE1E,iBAAiB;EACjB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB/B,kBAAkB;EAClB,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,SAAS,cAAc,CAAC,IAAsB,EAAE,KAAuB;IACrE,OAAO,mBAAmB,IAAI;;;oBAGZ,IAAI;;;;;;;;6BAQK,KAAK;;EAEhC,qBAAqB;;;;EAIrB,iBAAiB;EACjB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG;EACzB,kBAAkB;qEACiD,CAAC;AAEtE,wEAAwE;AACxE,MAAM,mBAAmB,GAAG;EAC1B,kBAAkB;qEACiD,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;EAkB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;EAexB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,SAAS,YAAY,CAAC,IAAmC;IACvD,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1F,MAAM,IAAI,GACR,IAAI,KAAK,OAAO;QACd,CAAC,CAAC;;iFAEyE;QAC3E,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC;;oEAE0D;YAC5D,CAAC,CAAC;;gDAEsC,CAAC;IAE/C,OAAO,YAAY,IAAI,qBAAqB,IAAI;;;aAGrC,IAAI,gCACb,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAC3C;;;;iEAKE,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,EACN;;;;;;EAMA,IAAI;;oCAE8B,IAAI;EACtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;EAkBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;2DAY2B,gBAAgB;;;;;;;;;;;EAWzE,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;EAmBxB,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;EAmBvB,kBAAkB;;;EAGlB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBxB,kBAAkB;EAClB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;EAmB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;EAkBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAE3B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB5B,kBAAkB;EAClB,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB9B,kBAAkB;EAClB,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;6DAYoC,gBAAgB;IACzE,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;;;;;;;;EAQ/C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB7B,kBAAkB;EAClB,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBvB,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB5B,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB5B,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB9B,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;EAUzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;EAiB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;EAoB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;EAmB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;AAEpC,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;EAWzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAEd,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,YAAY,GAAG;iEAC4C,CAAC;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,YAAY;;EAEZ,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;EAoB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;EAoB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAE;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;EAejC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;EAkB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;EAiBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;EAmBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;EAcpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;EAmBhC,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;EAezC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;yDAC4C,CAAC;AAE1D,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;EAYvB,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC"}
@@ -75,9 +75,26 @@ import { type ClassifiedSegment, type CommandClassification, type ProtectedPathE
75
75
  import { type GateOptions } from "../core/gate.js";
76
76
  import { type HarnessKind } from "../core/harness-version.js";
77
77
  import { type HarnessLoopState } from "../core/loop.js";
78
- import type { EventRecord } from "../core/log.js";
78
+ import { type EventRecord } from "../core/log.js";
79
+ import { type ReadRecordsResult } from "../core/state.js";
79
80
  import type { Streams } from "./main.js";
80
81
  import { type Style } from "./style.js";
82
+ /**
83
+ * How many CONSECUTIVE torn-tail reads the decision wait reads past before it
84
+ * treats the log as unreadable (APRV-427 review).
85
+ *
86
+ * The poll reads the log while other writers append to it: the daemon beside
87
+ * a CLI hook, and every other hook call beside one run by `approval serve`. An
88
+ * append is one write on an O_APPEND handle, but a reader on a filesystem that
89
+ * grows a file a page at a time can see the front of a line before its end, and
90
+ * the verified read calls that a torn tail. It is a moment in someone else's
91
+ * write, and the next tick reads the whole line. Treating it as terminal
92
+ * withdrew a live question and denied `hook-io` because a DIFFERENT call was
93
+ * mid-append. So a torn read is read again next tick, like a view that lags;
94
+ * only a tail that stays torn for this many ticks in a row (a crashed write,
95
+ * which nobody is going to finish) takes the old withdraw-and-deny path.
96
+ */
97
+ export declare const TORN_TAIL_RETRIES = 5;
81
98
  /**
82
99
  * How much of the command line goes in the (claimed) summary field.
83
100
  *
@@ -166,8 +183,36 @@ export declare const HOOK_DENY_CODES: readonly [
166
183
  * directory, once. Past the grace the hook withdraws it (reason `timeout`),
167
184
  * because a question nothing will adopt is a message on a phone that decides
168
185
  * nothing.
186
+ *
187
+ * **Who withdraws, stated because the deny text used to imply a scheduler
188
+ * that does not exist (APRV-410).** This process is over when it denies, so
189
+ * the withdrawal is made by the NEXT gated tool call this actor makes, from
190
+ * the sweep at the top of every gated invocation. It cannot be anyone else: a
191
+ * withdrawal is the requester's own (APRV-106 rule 1, `not-requester`), the
192
+ * gate refuses a `system:` withdrawal outright, and the event schema binds
193
+ * the one `system:` withdrawal that exists to `policy-drift` and to nothing
194
+ * else (APRV-235). So a session that denies here and then makes no further
195
+ * gated call leaves the question pending until the TTL, and a decision on it
196
+ * lands as an ordinary grant. What stops that grant authorizing anything is
197
+ * the other half of APRV-410: a retry past the grace does not carry it
198
+ * (`findHarnessCarry`), so it asks again.
169
199
  */
170
200
  "hook-timeout",
201
+ /**
202
+ * The harness ceiling this hook was told it runs under leaves no window a
203
+ * human could answer in (APRV-423).
204
+ *
205
+ * `--harness-cap` (or the harness's own documented maximum) at or below
206
+ * `HARNESS_CAP_MARGIN_MS` means the question would lapse at the instant it
207
+ * was asked: the request must end a margin before the harness kills the
208
+ * process that opened it, and there is no room left for the asking. Nothing
209
+ * is registered, nothing is requested and nobody's phone lights up. The
210
+ * repair is a configuration change — raise the harness entry's timeout, or
211
+ * state the real one — and it is a refusal rather than a silent widening
212
+ * because a hook that quietly ignored its own ceiling would be back to
213
+ * recording grants on calls nobody holds.
214
+ */
215
+ "hook-harness-cap-too-short",
171
216
  /** The gate refused intake; the gate's own code follows a colon. */
172
217
  "hook-gate-refused",
173
218
  /**
@@ -250,6 +295,32 @@ export declare const HOOK_DENY_CODES: readonly [
250
295
  * and it cannot recall a prompt the model has already been sent.
251
296
  */
252
297
  "hook-muse-contributor-model",
298
+ /**
299
+ * A Hermes Agent `execute_code` call, refused before anything else looks at
300
+ * it (APRV-398).
301
+ *
302
+ * The tool takes a `code` string and runs it in-process. There is no path, no
303
+ * argv and no working directory: nothing the classifier reads exists in the
304
+ * call, so no class can be resolved and no payload can bind what will happen.
305
+ * A verdict over `{code}` would authorize a program this runtime never
306
+ * parsed, which is the same hole `hook-opaque` closes for `bash -c` and the
307
+ * same one `hook-unsupported-execution-context` closes for a command whose
308
+ * directory is invisible. SPEC.md §11.1 says ambiguity resolves to the
309
+ * stricter path, and the strictest honest answer to "may I run this arbitrary
310
+ * program" is no.
311
+ *
312
+ * Distinct from `hook-opaque`, and the distinction is the repair. That one
313
+ * says a command line carried a construct the classifier could not read, and
314
+ * the fix is to write the command differently. This one says the TOOL has no
315
+ * readable surface at all on this harness, so there is no spelling of an
316
+ * `execute_code` call that would be answered differently: the repair is to do
317
+ * the work through the shell tool, where the words are visible and the
318
+ * classifier can price them, or through `approval run` with a granted token.
319
+ *
320
+ * Distinct from `hook-unclassified`, which says the classifier had nothing to
321
+ * say about bytes it could see. Here there are no bytes to see.
322
+ */
323
+ "hook-hermes-execute-code-unbound",
253
324
  /** Malformed hook input, or a log/filesystem fact that stopped the check. */
254
325
  "hook-io"];
255
326
  export type HookDenyCode = (typeof HOOK_DENY_CODES)[number];
@@ -278,12 +349,47 @@ export declare function hookScope(flags: Record<string, string | boolean>, cwd:
278
349
  * harnesses this runtime speaks a protocol for is the same set it knows a
279
350
  * binary name for, and two copies of it would be two lists to drift.
280
351
  */
352
+ /**
353
+ * What a harness's own non-shell, non-file tool asks for (APRV-445).
354
+ *
355
+ * `gated` names the class the call is judged under and the headline the
356
+ * approver reads; the payload is always the WHOLE call (`{tool, input}`), so a
357
+ * grant binds every argument the harness will act on. `read` is a call that
358
+ * touches nothing and is allowed without a record, exactly as an in-scope read
359
+ * tool is. A rule returns `null` for a tool it does not know, and that tool
360
+ * keeps the not-a-gated-tool allow every unknown tool has.
361
+ */
362
+ type ToolRuleVerdict = {
363
+ kind: "gated";
364
+ cls: string;
365
+ headline: string;
366
+ } | {
367
+ kind: "read";
368
+ reason: string;
369
+ };
370
+ /**
371
+ * The ceiling a harness puts on its hook process, in milliseconds, or `null`
372
+ * (APRV-423): the operator's stated `--harness-cap` clamped to the adapter's
373
+ * contractual maximum, or, with nothing stated, the adapter's documented
374
+ * default, falling back to that maximum.
375
+ *
376
+ * Exported so `approval serve` computes the same number the hook will before
377
+ * it hands the call to a thread (APRV-427 review): the budget a queued call
378
+ * has left is this less the time it has waited.
379
+ */
380
+ export declare function effectiveHarnessCapMs(adapter: Pick<HarnessAdapter, "capCeilingMs" | "capDefaultMs">, statedCapMs: number | null): number | null;
281
381
  interface HarnessAdapter {
282
382
  kind: HarnessKind;
283
383
  originApp: string;
284
384
  defaultActor: string;
285
385
  shellTool: string;
286
386
  fileTools: readonly string[];
387
+ /**
388
+ * The harness's own tools that carry a side effect of their own, by name and
389
+ * arguments (APRV-445). Consulted after the shell, file and read tools, for
390
+ * the calls none of those owns.
391
+ */
392
+ toolRules?: (toolName: string, toolInput: Record<string, unknown>) => ToolRuleVerdict | null;
287
393
  /**
288
394
  * Tools that READ a named path (APRV-347).
289
395
  *
@@ -329,6 +435,47 @@ interface HarnessAdapter {
329
435
  * its shell arm refuses outright; Claude Code has only the top-level one.
330
436
  */
331
437
  shellCwdKey?: string;
438
+ /**
439
+ * The hard ceiling this harness's own contract puts on one hook process, in
440
+ * milliseconds, or absent when it documents none (APRV-423).
441
+ *
442
+ * A CEILING, not a configuration. Hermes states that a `hooks:` entry's
443
+ * `timeout` may not exceed 300 s, so no Hermes entry can outlive that however
444
+ * it is written, and this runtime may rely on it. Claude Code, Cursor, Grok,
445
+ * Muse and Codex document a DEFAULT hook timeout and no maximum, so they
446
+ * carry none: an adapter that guessed a ceiling would either invent a
447
+ * deadline the harness never imposed, or — worse, and the direction that
448
+ * actually costs something — guess high and leave the gap APRV-410 falls
449
+ * through. The operator states the entry they configured with
450
+ * `--harness-cap`, and the effective cap is the smaller of the two.
451
+ */
452
+ capCeilingMs?: number;
453
+ /**
454
+ * The ceiling this harness imposes on a hook process when the operator has
455
+ * stated none, in milliseconds, or absent when the harness's defaults leave
456
+ * the process unbounded (APRV-423, second review pass).
457
+ *
458
+ * Read ONLY when `--harness-cap` is absent, and then it stands in for the
459
+ * flag: the operator has said nothing, so the runtime assumes the harness is
460
+ * running as shipped. It is the STRICTEST bound the harness's own defaults
461
+ * put on the process, because assuming a looser one is APRV-410 with a
462
+ * fictional deadline: a request judged against a window the harness will not
463
+ * keep open. On Hermes that is `plugins.hook_callback_timeout`, which bounds
464
+ * the whole hook dispatch and defaults to 30 s, well under the margin, so a
465
+ * Hermes hook with no flag is refused `hook-harness-cap-too-short` until the
466
+ * operator raises that setting and says so. A stated flag replaces this
467
+ * value (the operator knows what they configured) and is still clamped by
468
+ * {@link capCeilingMs}, so a stated cap can only shorten the contractual
469
+ * maximum, never exceed it.
470
+ */
471
+ capDefaultMs?: number;
472
+ /**
473
+ * How an operator lifts a `hook-harness-cap-too-short` refusal on this
474
+ * harness, in the harness's own vocabulary (APRV-423, second review pass).
475
+ * Appended to the deny so the repair names the setting to change rather than
476
+ * a generic "raise the timeout". Absent adapters get the generic sentence.
477
+ */
478
+ capRepair?: string;
332
479
  /**
333
480
  * Refuse every tool call when the envelope names a Contributor-tier model
334
481
  * (APRV-350).
@@ -340,6 +487,19 @@ interface HarnessAdapter {
340
487
  */
341
488
  contributorModelGuard?: boolean;
342
489
  }
490
+ /**
491
+ * Hermes Agent's event names, which are its own and not Claude Code's
492
+ * (APRV-398).
493
+ *
494
+ * snake_case, and the VERBS differ too: `pre_tool_call` where every other
495
+ * harness in this table says `PreToolUse`. That is why they are constants
496
+ * rather than two more entries in {@link POST_TOOL_EVENTS} — a harness whose
497
+ * post-event name appeared in that shared list would also accept
498
+ * `PostToolUse` from an event nobody sent, and the dispatch would answer a
499
+ * name this harness never uses.
500
+ */
501
+ export declare const HERMES_PRE_TOOL_EVENT = "pre_tool_call";
502
+ export declare const HERMES_POST_TOOL_EVENT = "post_tool_call";
343
503
  /**
344
504
  * Every harness this runtime speaks a hook protocol for, by kind (APRV-358).
345
505
  *
@@ -358,6 +518,72 @@ interface HarnessAdapter {
358
518
  * failed.
359
519
  */
360
520
  export declare const HARNESS_ADAPTERS: Readonly<Record<HarnessKind, HarnessAdapter>>;
521
+ /**
522
+ * The block directive a harness reads, as bytes, for a refusal raised OUTSIDE
523
+ * the hook (APRV-421).
524
+ *
525
+ * `approval serve` can refuse a hook request before `commandHook` is reached
526
+ * at all: an oversized body, a credential at the wrong door, a method it does
527
+ * not answer. Each of those is a refusal by the transport, and a transport
528
+ * refusal a harness reads as "no verdict" is a harness that runs the command.
529
+ * So the refusal has to be spoken in the harness's own dialect, and the only
530
+ * correct source of that dialect is the function that prints it here.
531
+ *
532
+ * It renders through {@link deny} for that reason: one construction site per
533
+ * harness, still never `ask`. The exit code returned is the one the verb would
534
+ * have carried; a caller may impose a stricter one, and the transport does.
535
+ */
536
+ export declare function harnessBlockDirective(code: string, detail: string, harness: HarnessKind): {
537
+ stdout: string;
538
+ exitCode: number;
539
+ };
540
+ /**
541
+ * Raised on `globalThis` while the runtime's own Hermes signal guards are
542
+ * registered (APRV-466). The `approval` bin reads the same registry symbol and
543
+ * steps aside while it is `true`, so the bin and the runtime never both print.
544
+ * An explicit flag rather than a listener count: an unrelated listener that
545
+ * does not exit must not switch the bin's guard off.
546
+ */
547
+ export declare const HERMES_SIGNAL_OWNER: unique symbol;
548
+ /**
549
+ * The block directive a Hermes hook prints when a signal arrives before it
550
+ * reached a verdict (APRV-445, APRV-466), as bytes.
551
+ *
552
+ * Two places print it: `hermesFailClosed`'s guard below, and the `approval` bin
553
+ * (`cli.js`), which has to answer a signal that lands while this module is
554
+ * still loading and so cannot import it. The bin spells the same bytes by hand,
555
+ * and `tests/hermes-bin-signal-guard.test.ts` pins the two equal, so the
556
+ * early-signal answer is one code with one spelling (SPEC.md §11.1 invariant
557
+ * 6). The wait's own handler words its message differently ("while waiting for
558
+ * a decision") under the same code.
559
+ *
560
+ * On the CLI the runtime's guard prints it for a signal held through the
561
+ * synchronous stretch before the first spend (the stdin read, the
562
+ * classification), at the pause `BEFORE_SPEND` (APRV-473); the bin prints it
563
+ * for a signal during the load (docs/hermes-hook.md, "Two layers against a
564
+ * signal").
565
+ */
566
+ export declare function hermesInterruptedDirective(signal: NodeJS.Signals): string;
567
+ /**
568
+ * The block directive a harness wait answers when a SIGTERM or SIGINT ends it
569
+ * (APRV-473 for Hermes, APRV-475 for every harness), as bytes and exit code.
570
+ *
571
+ * It is the harness's ORDINARY deny, built by {@link harnessBlockDirective}
572
+ * and so by {@link deny}, under the `hook-interrupted` code: the nested
573
+ * `hookSpecificOutput` deny at exit 0 for Claude Code, Codex and Muse,
574
+ * `{permission:"deny"}` at exit 0 for Cursor, `{decision:"deny"}` at exit 2
575
+ * for Grok, `{action:"block"}` at exit 2 for Hermes. One construction site per
576
+ * harness, so the answer to an interruption is spelled exactly as every other
577
+ * refusal that harness receives from this hook, and a harness that blocks on
578
+ * those blocks on this. `tests/harness-wait-interrupt.test.ts` pins the bytes
579
+ * per harness.
580
+ */
581
+ export declare function interruptedWaitDirective(signal: NodeJS.Signals, harness: HarnessKind): {
582
+ stdout: string;
583
+ exitCode: number;
584
+ };
585
+ /** The machine-readable code a Hermes `execute_code` call is refused with. */
586
+ export declare const HERMES_EXECUTE_CODE_REFUSAL = "hook-hermes-execute-code-unbound";
361
587
  /** The machine-readable code a Contributor-tier session is refused with. */
362
588
  export declare const MUSE_CONTRIBUTOR_REFUSAL = "hook-muse-contributor-model";
363
589
  export interface HookInput {
@@ -500,12 +726,48 @@ export declare function resolveReadRoots(cwd: string, gateRoot: string, declared
500
726
  */
501
727
  export declare function refineReadScope(result: CommandClassification, roots: readonly string[], cwd: string): RefinedClassification;
502
728
  /**
503
- * The classifier, its context, and all three impure refinements, in the one
729
+ * The roots a write may land in, resolved.
730
+ *
731
+ * The scratch roots are the ones `resolveScratchRoots` already computes and
732
+ * already guards, so this rule and the delete rule cannot disagree about where
733
+ * the agent's own scratch is. The working directory is the other one, and it is
734
+ * the root the classifier's own text rule already implies: "a relative
735
+ * destination is the workspace" means the workspace is wherever the command
736
+ * runs.
737
+ *
738
+ * `cwd` is harness-supplied, and reading a root out of it does not offend
739
+ * SPEC.md §11.1 invariant 4, because this pass only ever narrows. The baseline
740
+ * it narrows from is no check at all, so a poisoned `cwd` buys back exactly
741
+ * today's answer and never a looser one. Compare the read pass, which checks
742
+ * containment against the GATE root: that pass decides whether a read is in
743
+ * scope at all, so the scope has to be one the subject cannot choose. This one
744
+ * only takes an allowance away.
745
+ */
746
+ export declare function resolveWriteRoots(cwd: string): string[];
747
+ /**
748
+ * Tighten a `files.write.workspace` segment to the out-of-scope write class
749
+ * wherever the disk disagrees with the text.
750
+ *
751
+ * IMPURE by design and by contract, exactly as the other two passes are. The
752
+ * class it tightens to is the one `core/command-class.ts` already answers for
753
+ * an out-of-scope packaging destination rather than a new name: a class no
754
+ * policy mentions resolves by `defaults.autonomy` (SPEC.md §7), so minting
755
+ * `files.write.out_of_scope` here would arrive AUTONOMOUS in every deployment
756
+ * with permissive defaults, which is the one way a tightening pass could
757
+ * loosen something.
758
+ *
759
+ * `roots` empty means the caller asked for no write scoping, and every segment
760
+ * comes back untouched: the same "absent yields today's answer" the read pass
761
+ * promises.
762
+ */
763
+ export declare function refineWriteScope(result: CommandClassification, roots: readonly string[], cwd: string): RefinedClassification;
764
+ /**
765
+ * The classifier, its context, and all four impure refinements, in the one
504
766
  * order every caller must use.
505
767
  *
506
768
  * `hook classify` printing a different class from the one `hook claude-code`
507
769
  * decides would make the explainer a different program (APRV-108's note), and
508
- * that stays true now there are three refinements in the chain.
770
+ * that stays true now there are four refinements in the chain.
509
771
  *
510
772
  * `readRoots` is the one argument whose ABSENCE is the loose answer rather than
511
773
  * the strict one (APRV-347), so it is passed explicitly at every call site: an
@@ -523,7 +785,110 @@ export declare function classifyForHook(command: string, protectedPaths: readonl
523
785
  * that the `json` veto on colour is the answer this process memoizes.
524
786
  */
525
787
  export declare function renderClassification(result: CommandClassification, json: boolean, st?: Style): string;
788
+ /**
789
+ * The gate path from the event to a verdict, as steps (APRV-473).
790
+ *
791
+ * Each value the generator yields is a pause in milliseconds: the wait's poll
792
+ * interval, or `0` for one turn of the event loop and nothing longer. The
793
+ * return value is the verdict. ONE implementation of classify, register,
794
+ * request, wait and spend, run by one of two drivers:
795
+ *
796
+ * - {@link driveSync} sleeps each pause with `Atomics.wait`. Every caller that
797
+ * needs a synchronous answer keeps one: `commandHook` for the in-process
798
+ * callers and the serve worker, `decideHarnessCall` for the Codex bridge. A
799
+ * zero pause is no pause, so their behaviour is what it was.
800
+ * - {@link driveYielding} sleeps each pause on a timer, so the event loop turns
801
+ * while the hook waits and a JS signal listener runs then. Every
802
+ * `approval hook <harness>` CLI route runs through it: Hermes first
803
+ * (APRV-473), which sends SIGTERM on its hook timeout and on gateway
804
+ * shutdown, then Claude Code, Cursor, Codex, Grok and Muse (APRV-475). A
805
+ * signal held through a synchronous wait let a grant that landed afterwards
806
+ * record `execution.started` for a call the harness had already abandoned.
807
+ * The harness makes no difference to the steps: the pause before a spend
808
+ * ({@link BEFORE_SPEND}) and the wait's withdrawing handler are the same code
809
+ * for all six, and only the directive the handler prints is the harness's
810
+ * own ({@link interruptedWaitDirective}).
811
+ *
812
+ * The pauses are the same durations under either driver, so the deadline
813
+ * arithmetic and the poll cadence do not depend on which one runs them.
814
+ *
815
+ * Each `next()` also tells the steps which driver is running them (APRV-478):
816
+ * `true` from {@link driveYielding}, a pause that turns the event loop, and
817
+ * `false` or nothing from {@link driveSync}. The one step that reads it is
818
+ * {@link spendUnderLock}, which waits for the log's lock on the event loop
819
+ * only when there is an event loop to wait on, and otherwise runs the writer's
820
+ * own synchronous wait exactly as before.
821
+ */
822
+ type GateSteps<T> = Generator<number, T, boolean | undefined>;
823
+ /**
824
+ * Where a hook invocation stops appending and starts waiting, for a caller that
825
+ * shares one store with other work in the same process (APRV-427).
826
+ *
827
+ * `approval serve` runs many hook calls, verbs and log reads against one store
828
+ * from one process. Its per-store lock has to cover every stretch in which a
829
+ * hook call APPENDS (intake, the abandoned-question sweep, register, request,
830
+ * the spend, the withdrawals) so that no other in-process writer lands between
831
+ * a check and its append; and it must NOT cover the poll loop, where the hook
832
+ * only reads the verified log and sleeps, or one question waiting on a human
833
+ * holds the tenant's whole facade for as long as the human takes.
834
+ *
835
+ * So the loop says where it begins and ends. `enterWait` is called once, right
836
+ * before the first poll, and after it nothing is appended until `leaveWait`
837
+ * returns. `leaveWait` is called before every append the loop can reach (the
838
+ * spend on a grant, a withdrawal on a failed read, at the deadline, on a throw
839
+ * or a signal) and once more when the loop is left by any route, and it may
840
+ * BLOCK until the caller's lock is held again. Both are idempotent pairs: the
841
+ * hook never calls `leaveWait` without a matching `enterWait` before it.
842
+ *
843
+ * Absent (the CLI, the Codex bridge), both are no-ops and the invocation is
844
+ * byte-for-byte what it was. The seam decides nothing: no verdict, record or
845
+ * line depends on it, and the appends it brackets are compare-and-append
846
+ * either way (SPEC.md §11.1 invariant 5). It only tells an embedding caller
847
+ * which stretch of the call is safe to run beside other writers.
848
+ */
849
+ export interface HookWaitSeam {
850
+ /** The poll loop is about to start: nothing is appended until {@link leaveWait}. */
851
+ enterWait(): void;
852
+ /** An append follows, or the loop is over. May block until the caller's lock is held. */
853
+ leaveWait(): void;
854
+ /**
855
+ * The read each poll tick makes. Omitted by every real caller, which gets
856
+ * `readVerifiedRecords`; it exists so a test can put a torn read in front of
857
+ * the loop without writing a torn line into a log.
858
+ */
859
+ pollRead?: (logPath: string) => ReadRecordsResult;
860
+ /**
861
+ * Whether the party this invocation answers has gone away (APRV-427 review).
862
+ *
863
+ * `approval serve` sets it when the HTTP client that asked disconnects. Read
864
+ * on every poll tick, and once more after the lock is re-taken and before a
865
+ * grant is spent: while it is set, the invocation stops waiting WITHOUT
866
+ * spending and WITHOUT withdrawing, so the question (or its grant) is left
867
+ * exactly as a hook-timeout inside the retry grace leaves it, for the
868
+ * harness's retry to adopt. A grant already spent is not affected: the check
869
+ * precedes the spend, and nothing after it looks again.
870
+ */
871
+ cancelled?: () => boolean;
872
+ /**
873
+ * What is LEFT of the harness's ceiling when this invocation begins, in
874
+ * milliseconds, as the embedding caller measured it (APRV-427 review).
875
+ *
876
+ * The harness's ceiling runs from the moment the harness sent the call, not
877
+ * from the moment this invocation began. `approval serve` may hold a call in
878
+ * line for a thread, and for the store lock, before the hook's first line
879
+ * runs; that time is spent out of the same budget. The caller computes the
880
+ * remainder ONCE, admits the call on it, and hands the same number here, so
881
+ * the hook judges, waits by and records on the request exactly what the
882
+ * caller admitted: a call the caller let through never meets
883
+ * `hook-harness-cap-too-short` a few milliseconds later. It can only
884
+ * shorten the ceiling the flags give (never lengthen it), and it is omitted
885
+ * by the CLI, where the process starts when the harness calls.
886
+ */
887
+ remainingCapMs?: number;
888
+ }
526
889
  interface HookRun {
890
+ /** APRV-427: the embedding caller's wait seam, or `null` from the CLI. */
891
+ waitSeam: HookWaitSeam | null;
527
892
  logPath: string;
528
893
  options: GateOptions;
529
894
  actor: string;
@@ -539,6 +904,57 @@ interface HookRun {
539
904
  graceMs: number;
540
905
  /** `defaults.approval_ttl`, or `null` when the policy declares none. */
541
906
  ttlMs: number | null;
907
+ /**
908
+ * The ceiling this harness puts on this process, in milliseconds, or `null`
909
+ * (APRV-423).
910
+ *
911
+ * The entry timeout the operator stated with `--harness-cap`, clamped to the
912
+ * harness's own documented maximum ({@link HarnessAdapter.capCeilingMs}); or,
913
+ * when no flag was passed, the harness's default bound
914
+ * ({@link HarnessAdapter.capDefaultMs}, falling back to the ceiling). It is
915
+ * written onto every request this invocation opens and read back by the gate,
916
+ * which judges the question against the shorter of it (minus the margin) and
917
+ * the policy's TTL — so the request ends while this process is still alive to
918
+ * be told, and the daemon's `approval.expired` lands before the harness gives
919
+ * up.
920
+ */
921
+ harnessCapMs: number | null;
922
+ /**
923
+ * Whether {@link harnessCapMs} came from the operator's own `--harness-cap`
924
+ * (`true`) or was assumed from the adapter's documented defaults (`false`).
925
+ * A refusal for a cap with no room in it says which, because the repair
926
+ * differs: a stated cap is a real configuration to raise, an assumed one is
927
+ * a flag the operator has not passed yet.
928
+ */
929
+ harnessCapStated: boolean;
930
+ /**
931
+ * The ceiling {@link harnessCapMs} was charged down from, or `null` where
932
+ * nothing was charged (APRV-427 review). Wording only.
933
+ */
934
+ harnessCapCeilingMs: number | null;
935
+ /** {@link HarnessAdapter.capRepair}, or `null` for the generic sentence. */
936
+ harnessCapRepair: string | null;
937
+ /**
938
+ * How long THIS invocation actually waits, in milliseconds (APRV-423, third
939
+ * review pass): `timeoutMs`, clamped to what the harness ceiling leaves after
940
+ * the margin (`harnessCapMs - HARNESS_CAP_MARGIN_MS`) when there is one, and
941
+ * never below zero.
942
+ *
943
+ * The clamp is what closes the adopted-question gap. The too-short refusal
944
+ * fires only for a question this invocation would OPEN; an invocation whose
945
+ * every key is adopted (a retry of bytes an earlier, correctly-capped run
946
+ * asked about) opens nothing, so under a ceiling with no room in it (a Hermes
947
+ * hook with no `--harness-cap`, assumed 30 s) it would have sat in its poll
948
+ * loop for the configured wait, been killed at the ceiling, and let the call
949
+ * proceed on any harness without `fail_closed`. Bounding the wait itself means
950
+ * the hook always answers before the harness stops listening: a zero wait
951
+ * reads the verified log once (so a decision already recorded is still
952
+ * honoured) and then denies `hook-timeout`, leaving the adopted question open
953
+ * for the retry grace exactly as a wait that ran out would. The adopted
954
+ * question's OWN deadline is whatever was recorded when it was opened; this
955
+ * changes nothing about it.
956
+ */
957
+ waitMs: number;
542
958
  harness: HarnessKind;
543
959
  originApp: string;
544
960
  /** Exact native command bytes required in a Codex allow's identity update. */
@@ -627,7 +1043,9 @@ export type HarnessVerdict = {
627
1043
  code: string;
628
1044
  detail: string;
629
1045
  };
630
- export declare function gateHarnessCall(streams: Streams, run: HookRun, classes: string[],
1046
+ export declare function gateHarnessCall(...args: Parameters<typeof gateHarnessSteps>): HarnessVerdict;
1047
+ /** {@link gateHarnessCall} as steps, for a driver that yields (APRV-473). */
1048
+ declare function gateHarnessSteps(streams: Streams, run: HookRun, classes: string[],
631
1049
  /**
632
1050
  * The bytes the grant binds to: `{command, cwd}` for a Bash call, the change
633
1051
  * itself for a file tool (APRV-124). Whatever this is, it is what reaches the
@@ -661,7 +1079,7 @@ note?: string,
661
1079
  * reads, and {@link floorApplies} below carves the read classes out of a mixed
662
1080
  * one, so a floor never puts a question about looking on a human's phone.
663
1081
  */
664
- floor?: HarnessLoopState | null): HarnessVerdict;
1082
+ floor?: HarnessLoopState | null): GateSteps<HarnessVerdict>;
665
1083
  /**
666
1084
  * Every line the counterpart can print, closed and machine-readable (§11.1
667
1085
  * invariant 7).
@@ -755,6 +1173,26 @@ export interface DecideInput {
755
1173
  timeoutMs: number;
756
1174
  intervalMs: number;
757
1175
  graceMs: number;
1176
+ /**
1177
+ * The harness's ceiling on this process, in milliseconds, or `null`
1178
+ * (APRV-423). See {@link HookRun.harnessCapMs}. A caller that is not run by a
1179
+ * harness on a timer — `cli/codex-bridge.ts` holds its own connection open —
1180
+ * passes `null` and the policy's TTL governs alone.
1181
+ */
1182
+ harnessCapMs?: number | null;
1183
+ /**
1184
+ * Whether `harnessCapMs` was stated by the operator (`--harness-cap`) rather
1185
+ * than assumed from the adapter's documented defaults (APRV-423, second
1186
+ * review pass). Defaults to `false`; see {@link HookRun.harnessCapStated}.
1187
+ */
1188
+ harnessCapStated?: boolean;
1189
+ /**
1190
+ * The ceiling `harnessCapMs` was charged down from, where an embedding
1191
+ * caller charged time spent before this invocation began (APRV-427 review).
1192
+ * Wording only: a refusal names both, so the operator's stated number is
1193
+ * not reported as the remainder.
1194
+ */
1195
+ harnessCapCeilingMs?: number;
758
1196
  /** Exact native command bytes a Codex allow must carry back, where there are any. */
759
1197
  codexCommand?: string | undefined;
760
1198
  /**
@@ -765,6 +1203,12 @@ export interface DecideInput {
765
1203
  * lookup passes `null`, and both of them read the log themselves.
766
1204
  */
767
1205
  windowRecords: EventRecord[] | null;
1206
+ /**
1207
+ * Where the wait begins and ends, for a caller that runs this beside other
1208
+ * writers in one process (APRV-427; see {@link HookWaitSeam}). Omitted by
1209
+ * every CLI route, where it is a no-op.
1210
+ */
1211
+ waitSeam?: HookWaitSeam | null;
768
1212
  }
769
1213
  /**
770
1214
  * Classify, resolve, gate and wait: one harness tool call, from the event to a
@@ -783,5 +1227,40 @@ export interface DecideInput {
783
1227
  * progress and withdrawal lines, which are a report rather than a decision.
784
1228
  */
785
1229
  export declare function decideHarnessCall(decide: DecideInput): HarnessVerdict;
786
- export declare function commandHook(argv: string[], streams: Streams, cwd: string, readStdin?: () => string): number;
1230
+ export declare function commandHook(argv: string[], streams: Streams, cwd: string, readStdin?: () => string,
1231
+ /**
1232
+ * APRV-427: where a harness hook's wait begins and ends, for `approval serve`,
1233
+ * which runs the call off its main thread and releases its store lock while
1234
+ * the call polls. Every CLI route omits it. See {@link HookWaitSeam}.
1235
+ */
1236
+ waitSeam?: HookWaitSeam | null): number;
1237
+ /**
1238
+ * {@link commandHook}, with its pauses on the event loop (APRV-473).
1239
+ *
1240
+ * Every `approval hook` CLI route, from `main`: Hermes since APRV-473, the
1241
+ * other five harnesses (and `classify`, which never pauses) since APRV-475.
1242
+ * The same steps as the synchronous form; the difference is that a SIGTERM or
1243
+ * SIGINT reaches the listener in force within one pause of arriving, instead
1244
+ * of after the run returns. In the wait that listener withdraws the question
1245
+ * this invocation opened, prints the harness's own `hook-interrupted` block
1246
+ * directive ({@link interruptedWaitDirective}) and exits with that directive's
1247
+ * exit code, so a grant that lands after the harness abandoned the call is
1248
+ * never spent on it. See {@link GateSteps} and {@link BEFORE_SPEND}.
1249
+ */
1250
+ export declare function commandHookYielding(argv: string[], streams: Streams, cwd: string, readStdin?: () => string): Promise<number>;
1251
+ /**
1252
+ * The steps {@link commandHook} and {@link commandHookYielding} drive, for a
1253
+ * test that drives them itself (APRV-475 refuter).
1254
+ *
1255
+ * A test seam and nothing more: it exists so a test can stop at each pause and
1256
+ * look at the log, which is the only deterministic way to pin that the pause
1257
+ * before a spend ({@link BEFORE_SPEND}) sits between the read that found a
1258
+ * grant and the append that spends it, on every harness. No CLI route and no
1259
+ * embedding caller uses it; the one entry for those is the two drivers above.
1260
+ *
1261
+ * Pass `true` to each `next()` to step as {@link commandHookYielding} does
1262
+ * (the spend then waits for a held log lock in yields, APRV-478); `false` or
1263
+ * nothing steps as {@link commandHook} does.
1264
+ */
1265
+ export declare function commandHookSteps(argv: string[], streams: Streams, cwd: string, readStdin: () => string): Generator<number, number, boolean | undefined>;
787
1266
  export {};